CENTRAL NETWORKS AND TECHNOLOGIES LIMITED

Microsoft M365

Microsoft 365

Features

• Microsoft Teams (Chat, Meetings & Collaboration)
• Outlook (Email & Calendar)
• SharePoint Online
• OneDrive for Business
• Word (Desktop + Web)
• Excel (Desktop + Web)
• PowerPoint
• Microsoft Defender for Office 365 (Security)
• Intune (Device & App Management)
• Copilot for Microsoft 365 (AI Assistance)

Benefits

• Streamlined Productivity & Workflow Efficiency
• Best‑in‑Class Office Applications (Cloud & Desktop)
• Enterprise‑Grade Email & Calendar with Exchange Online
• 1TB OneDrive Cloud Storage per User
• Real‑Time Collaboration via Teams & SharePoint
• Advanced Device & App Management with Intune
• Built‑In Security via Microsoft Defender
• Data Classification & Sensitivity Labelling (AIP)
• Data Loss Prevention (DLP)
• Integrated Compliance & Governance Features

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at Sales@centralnetworks.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

749309074104001

Contact

Tamar Waite
01706747474
Sales@centralnetworks.co.uk

About your service

• Service categories:

  Applications

  Production and operations

  • Other operations
• Multi cloud support: No

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: Microsoft Azure
• Cloud deployment model: Public cloud
• Service constraints: None
• System requirements: Dependant on Customer Environment

User support

• Email or online ticketing support: Yes
• Support response times: The aim is to respond to questions on the first call, through an escalation 1st-3rd line classification.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Our operations team is broken down into two areas, Service Desk and Engineering. The Service Desk acts as the primary source of all activity, where calls are categorised, prioritised and filtered to the relevant specialist if required. Our calls are given a priority level from 1-5; whereas P1 is Disaster, business is non-operational all the way through to P5, of which could be a cosmetic incident, for example. Our response times and levels are summarised below: P1 - Urgent - 15mins Response Time (RT), 4 hrs Target Full Fix Time(TFFT) P2 - Critical - 30 mins RT, 8 hrs TFFT P3 - Very Important - 4 hrs RT, 20 hrs TFFT P4 - Important - 10 hrs RT, 30 hrs TFFT P5 - Informational - 3 days RT, 90 days TFFT (never normally this long) The majority of activity will be remote based working, however we will send either a senior engineer to the client site, or a cloud specialist to a cloud hosting datacentre site, as and when required, depending on the incident. All priority incidents are included in our pricing, defined by customised SLA's and can be in unlimited numbers if required, depending on the client's needs
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: M365 is a public environment with various learning materials available.; Support and knowledge is available from Central is the customer wishes to increase their knowledge on the platform.
• Service documentation: Yes
• Documentation formats: HTML
• End-of-contract data extraction: Users can extract their Microsoft 365 data in several ways depending on the data type. Profile information such as contact details, job title, and organisational data can be exported directly from the profile card in Outlook on the web or OneDrive by selecting the ellipsis and choosing Export data, which downloads a JSON file containing the user’s stored profile information.
• End-of-contract process: When a Microsoft 365 tenant is closed—whether through non‑renewal, cancellation, or termination—the tenant and its data go through defined lifecycle stages before permanent deletion. Immediately after the subscription ends, the tenant enters the Expired state for the first 1–30 days, during which all users still have full access, and no data is deleted. ; After 30 days, the service moves into the Disabled state, lasting until day 120. In this period, users lose access, but administrators can still sign in, back up data, or reactivate the subscription. Data remains intact but is read‑only for all except admins. ; Once the Disabled period ends, the tenant enters the Deprovisioned state (post‑day 120). At this point, Microsoft begins permanent deletion of all customer data, including mailboxes, OneDrive files, SharePoint content, Teams chat data, and even data under legal hold. This deletion is irreversible. ; Microsoft’s broader Data Handling Standard states that customer content and identifiable data are fully removed no later than 180 days after subscription termination. ; Organisations leaving Microsoft 365 are strongly advised to back up all required data before the end of the Disabled period, as recovery becomes impossible once deletion begins.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: Yes
• Compatible operating systems: Windows
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Various mobile apps for the M365 productive suite are available
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: Web Interface
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: All Accessibility testing completed by Microsoft
• API: Yes
• What users can and can't do using the API: Microsoft supply a REST API platform. Full details can be found at https://learn.microsoft.com/en-us/rest/api/azure/
• API documentation: Yes
• API documentation formats: HTML
• API sandbox or test environment: No
• Customisation available: No

Scaling

• Independence of resources: The service sits within the customers Azure Subscription and has no impact on any other customers.

Analytics

• Service usage metrics: Yes
• Metrics types: Microsoft 365 provides users and admins with visibility into activity and usage metrics across the environment. These include active‑user counts, app usage trends, file activity, collaboration behaviour, storage consumption, communication patterns (email, Teams meetings and chats), and device/platform usage. Reports also highlight adoption trends, showing who is enabled, active, returning, or using services for the first time. Admins can drill into service‑specific metrics such as OneDrive usage, SharePoint site activity, and Teams engagement. These insights help organisations understand productivity, usage habits, and capacity needs.
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: Yes
• FOCUS resource tagging: No

Resellers

• Supplier type: Reseller providing extra support
• Organisation whose services are being resold: Microsoft

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
  • Other locations
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest: Other
• Other data at rest protection approach: Protected by Microsoft infrastructure and protocols
• Data sanitisation process: Yes
• Equipment disposal approach: In-house destruction process
• Data sanitisation type: Deleted data can’t be directly accessed / Cryptographic Erasure

Data importing and exporting

• Data export approach: Users can extract their Microsoft 365 data in several ways depending on the data type. Profile information such as contact details, job title, and organisational data can be exported directly from the profile card in Outlook on the web or OneDrive by selecting the ellipsis and choosing Export data, which downloads a JSON file containing the user’s stored profile information.
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • .pst
  • .docx
  • .xlsx
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Microsoft supply a service with an SLA of 99.9%
• Approach to resilience: Microsoft Azure spans multiple regions and availability zones to ensure the solution is always available.
• Outage reporting: Customer may subscribe to outage notifications via SMS and Email for the relevant services.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
• Access restrictions in management interfaces and support channels: Accsses is based on username and password with MFA. Access to functions is control via RBAC. There are a number of levels of roles including Backup, Restore, Reporting and Full Admin
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: Between 1 month and 6 months
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: Between 1 month and 6 months
• How long system logs are stored for: Between 1 month and 6 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: Other
• Other security governance standards: SOC 2 Type 2
• Information security policies and processes: Details around policies and procedures are not published to the public. Information can be requested during procurment if required
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Details around policies and procedures are not published to the public. Information can be requested during procurment if required
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Details around policies and procedures are not published to the public. Information can be requested during procurment if required
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Details around policies and procedures are not published to the public. Information can be requested during procurment if required
• Incident management type: Supplier-defined controls
• Incident management approach: Details around policies and procedures are not published to the public. Information can be requested during procurment if required
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: M365 Business Licenses

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0.25%
• Between £250,000 and £500,000: 0.5%
• Between £500,001 and £1,000,000: 0.75%
• Between £1,000,001 and £2,500,000: 1%
• Between £2,500,001 and £5,000,000: 1.25%
• Over £5,000,001: 1.5%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Citation
• ISO/IEC 27001 accreditation date: Monday 19 May 2025
• What the ISO/IEC 27001 doesn’t cover: None
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: Citation
• ISO 9001 accreditation date: Friday 3 January 2025
• What the ISO 9001 doesn’t cover: None
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 79646496-1330-4827-b087-691615c42291
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 106b321e-346f-4e5c-abd9-51b4fc523fa0
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

    • Activities that demonstrate a collaborative way to work with a diverse range of businesses as part of the supply chain

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at Sales@centralnetworks.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.